securityAlertsReview.yml

name: Security Alerts Review

# - ensures that all security alerts from olympix static analysis are properly handled before merging.
# - enforces a strict review policy where every alert must be either resolved or dismissed with a justification.
# - prevents merging a PR if any alerts are unresolved or dismissed without a comment.
# - helps maintain a transparent and collaborative security review process by generating a pr comment summarizing the status of all security alerts.

on:
  push:
    paths:
      - 'src/**.sol'
  pull_request:
    types:
      - synchronize
      - reopened
      - ready_for_review
  pull_request_review:
    types:
      - submitted
  workflow_dispatch:

jobs:
  check-security-alerts:
    runs-on: ubuntu-latest

    steps:
      # Ensure that the Olympix Static Analysis workflow has run successfully at least once before proceeding.
      # This check is necessary because the Security Alerts Review workflow should not proceed unless
      # a valid Olympix Static Analysis report is available for the current branch.
      - name: Check if Olympix Static Analysis has run at least once and was successful
        id: check-analysis
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH_NAME: ${{ github.head_ref }}
        run: |
          echo "Checking latest Olympix Static Analysis run for branch: $BRANCH_NAME"

          # Fetch the latest completed runs of the Olympix Static Analysis workflow
          LATEST_RUN=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" \
            "https://api.github.com/repos/${{ github.repository }}/actions/workflows/olympixStaticAnalysis.yml/runs?status=completed&per_page=10")

          echo "LATEST_RUN:"
          echo "$LATEST_RUN"

          # Filter to find the first run with head_branch matching our branch name
          WORKFLOW_STATUS=$(echo "$LATEST_RUN" | jq -r --arg branch "$BRANCH_NAME" '.workflow_runs[] | select(.head_branch == $branch) | .conclusion' | head -n1)
          echo "WORKFLOW_STATUS:"
          echo "$WORKFLOW_STATUS"

          if [[ "$WORKFLOW_STATUS" != "success" ]]; then
            echo "The Olympix Static Analysis workflow has not been successfully completed for branch: $BRANCH_NAME."
            echo "The Security Alerts Review workflow cannot continue because a valid Olympix Static Analysis report is required."
            exit 1
          fi

      - name: Fetch PR Number
        id: fetch_pr
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PR_NUMBER=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" \
            "https://api.github.com/repos/${{ github.repository }}/pulls?state=open" | jq -r '.[0].number')

          if [[ -z "$PR_NUMBER" || "$PR_NUMBER" == "null" ]]; then
            echo "No open PR found, skipping check."
            exit 0
          fi

          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
          echo "PR number: $PR_NUMBER"

      - name: Fetch Security Alerts for PR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Fetching security alerts for PR #${PR_NUMBER}..."
          
          # Fetch security alerts via GitHub API
          ALERTS=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" \
            "https://api.github.com/repos/${{ github.repository }}/code-scanning/alerts?pr=${PR_NUMBER}")

          # Log raw API response for debugging
          echo "Raw API Response:"
          echo "$ALERTS"

          # Extract unresolved alerts (open alerts)
          UNRESOLVED_ALERTS=$(echo "$ALERTS" | jq -c '[.[] | select(.state == "open") ]' || echo "[]")
          # Extract dismissed alerts without comments (empty dismissed_comment)
          DISMISSED_ALERTS=$(echo "$ALERTS" | jq -c '[.[] | select(.state == "dismissed" and (.dismissed_comment == null or .dismissed_comment == ""))]' || echo "[]")
          # Extract dismissed alerts with comments (successful dismissals)
          COMMENTED_ALERTS=$(echo "$ALERTS" | jq -c '[.[] | select(.state == "dismissed" and (.dismissed_comment != null and .dismissed_comment != ""))]' || echo "[]")

          UNRESOLVED_COUNT=$(echo "$UNRESOLVED_ALERTS" | jq -r 'length')
          DISMISSED_COUNT=$(echo "$DISMISSED_ALERTS" | jq -r 'length')
          COMMENTED_COUNT=$(echo "$COMMENTED_ALERTS" | jq -r 'length')

          # Output for debugging
          echo "UNRESOLVED_ALERTS: $UNRESOLVED_ALERTS"
          echo "DISMISSED_ALERTS (without comments): $DISMISSED_ALERTS"
          echo "COMMENTED_ALERTS (with comments): $COMMENTED_ALERTS"
          echo "UNRESOLVED_COUNT: $UNRESOLVED_COUNT"
          echo "DISMISSED_COUNT: $DISMISSED_COUNT"
          echo "COMMENTED_COUNT: $COMMENTED_COUNT"

          # Save values in the environment as single-line JSON
          echo "UNRESOLVED_ALERTS=$UNRESOLVED_ALERTS" >> $GITHUB_ENV
          echo "DISMISSED_ALERTS=$DISMISSED_ALERTS" >> $GITHUB_ENV
          echo "COMMENTED_ALERTS=$COMMENTED_ALERTS" >> $GITHUB_ENV
          echo "UNRESOLVED_COUNT=$UNRESOLVED_COUNT" >> $GITHUB_ENV
          echo "DISMISSED_COUNT=$DISMISSED_COUNT" >> $GITHUB_ENV
          echo "COMMENTED_COUNT=$COMMENTED_COUNT" >> $GITHUB_ENV

      - name: Find Existing PR Comment
        id: find_comment
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Searching for existing PR comment..."
          
          COMMENT_ID=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" \
            "https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" | jq -r \
            '.[] | select(.body | startswith("### 🤖 GitHub Action: Security Alerts Review")) | .id')

          if [[ -n "$COMMENT_ID" && "$COMMENT_ID" != "null" ]]; then
            echo "EXISTING_COMMENT_ID=$COMMENT_ID" >> $GITHUB_ENV
          fi

          echo "Found comment ID: $COMMENT_ID"

      - name: Post or Update PR Comment
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          COMMENT_BODY="### 🤖 GitHub Action: Security Alerts Review 🔍\n\n"

          # Add Unresolved Alerts
          if [[ "$UNRESOLVED_COUNT" -gt 0 ]]; then
            COMMENT_BODY+="🚨 **Unresolved Security Alerts Found!** 🚨\n"
            COMMENT_BODY+="The following security alerts must be **resolved** before merging:\n\n"

            while IFS= read -r row; do
              ALERT_URL=$(echo "$row" | jq -r '.html_url')
              ALERT_FILE=$(echo "$row" | jq -r '.most_recent_instance.location.path')
              ALERT_DESCRIPTION=$(echo "$row" | jq -r '.most_recent_instance.message.text')

              COMMENT_BODY+="🔴 [View Alert]($ALERT_URL) - **File:** \`$ALERT_FILE\`\n"
              COMMENT_BODY+="   🔹 $ALERT_DESCRIPTION\n\n"
            done < <(echo "$UNRESOLVED_ALERTS" | jq -c '.[]')
          fi

          # Add Dismissed Alerts Without Comments
          if [[ "$DISMISSED_COUNT" -gt 0 ]]; then
            COMMENT_BODY+="The following alerts were dismissed but require a dismissal comment:\n\n"

            while IFS= read -r row; do
              ALERT_URL=$(echo "$row" | jq -r '.html_url')
              ALERT_FILE=$(echo "$row" | jq -r '.most_recent_instance.location.path')
              ALERT_DESCRIPTION=$(echo "$row" | jq -r '.most_recent_instance.message.text')

              COMMENT_BODY+="🟡 [View Alert]($ALERT_URL) - **File:** \`$ALERT_FILE\`\n"
              COMMENT_BODY+="   🔹 $ALERT_DESCRIPTION\n\n"
            done < <(echo "$DISMISSED_ALERTS" | jq -c '.[]')
          fi

          if [[ "$UNRESOLVED_COUNT" -gt 0 || "$DISMISSED_COUNT" -gt 0 ]]; then
            COMMENT_BODY+="⚠️ **Please resolve the above issues before merging.**\n\n"
          fi

          # Add Dismissed Alerts With Comments (Successful dismissals)
          if [[ "$COMMENTED_COUNT" -gt 0 ]]; then
            COMMENT_BODY+="🟢 **Dismissed Security Alerts with Comments**\n"
            COMMENT_BODY+="The following alerts were dismissed with proper comments:\n\n"

            while IFS= read -r row; do
              ALERT_URL=$(echo "$row" | jq -r '.html_url')
              ALERT_FILE=$(echo "$row" | jq -r '.most_recent_instance.location.path')
              ALERT_DESCRIPTION=$(echo "$row" | jq -r '.most_recent_instance.message.text')
              DISMISS_REASON=$(echo "$row" | jq -r '.dismissed_reason')
              DISMISS_COMMENT=$(echo "$row" | jq -r '.dismissed_comment')
              CAPITALIZED_REASON=$(echo "$DISMISS_REASON" | sed 's/^\(.\)/\U\1/')

              COMMENT_BODY+="🟢 [View Alert]($ALERT_URL) - **File:** \`$ALERT_FILE\`\n"
              COMMENT_BODY+="   🔹 $ALERT_DESCRIPTION\n"
              COMMENT_BODY+="   🔹 Dismiss Reason: **$CAPITALIZED_REASON**\n"
              COMMENT_BODY+="   🔹 Dismiss Comment: $DISMISS_COMMENT\n\n"
            done < <(echo "$COMMENTED_ALERTS" | jq -c '.[]')
          fi

          # If no unresolved alerts and no dismissed alerts missing comments, add overall success message
          if [[ "$UNRESOLVED_COUNT" -eq 0 && "$DISMISSED_COUNT" -eq 0 ]]; then
            COMMENT_BODY+="✅ **No unresolved security alerts!** 🎉\n\n"
          fi

          # Update existing comment if found; otherwise, post a new one.
          if [[ -n "$EXISTING_COMMENT_ID" ]]; then
            echo "Updating existing comment ID: $EXISTING_COMMENT_ID"
            curl -s -X PATCH -H "Authorization: token ${GITHUB_TOKEN}" -H "Content-Type: application/json" \
              -d "{\"body\": \"$COMMENT_BODY\"}" \
              "https://api.github.com/repos/${{ github.repository }}/issues/comments/${EXISTING_COMMENT_ID}"
          else
            echo "Posting new comment to PR..."
            curl -s -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Content-Type: application/json" \
              -d "{\"body\": \"$COMMENT_BODY\"}" \
              "https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments"
          fi

      - name: Check if Action Should Fail
        run: |
          echo "🔍 Checking if the workflow should fail based on security alerts..."
          echo "UNRESOLVED_COUNT: $UNRESOLVED_COUNT"
          echo "DISMISSED_COUNT: $DISMISSED_COUNT"

          # Fail the workflow if there are unresolved alerts.
          if [[ "$UNRESOLVED_COUNT" -gt 0 ]]; then
            echo "❌ ERROR: $UNRESOLVED_COUNT unresolved security alerts found!"
            echo "⚠️ These alerts must be resolved before merging."
            exit 1
          fi

          # Fail the workflow if there are dismissed alerts without comments.
          if [[ "$DISMISSED_COUNT" -gt 0 ]]; then
            echo "❌ ERROR: $DISMISSED_COUNT security alerts were dismissed without comments!"
            echo "⚠️ Please provide a dismissal reason for these alerts."
            exit 1
          fi

          echo "✅ No blocking security issues found. The workflow will pass successfully."